Welcome to the Project Notebook for the V4 Retirement Project.
We would like to share some important information about Kerberos 4 with IS&T Managers. In the coming weeks, we will broaden the communication and community outreach as our plans solidify. This e-mail is being sent to share developing plans about phasing out our support for Kerberos 4 at MIT during the upcoming calendar year 2006. MIT remains committed to Kerberos and ensuring Kerberos 5 support for applications, as needed.
On January 27th of this year, the MIT Kerberos Development team announced plans to phase out support for Kerberos 4 in MIT Kerberos, including v4 support in Kerberos for Macintosh and Kerberos for Windows.
The MIT Kerberos team is making substantial changes to the client-side initial ticket acquisition support in the next release of Kerberos. These changes will improve the user experience for users who get tickets for multiple realms that do not share keys. Because we are no longer dedicating resources for new Kerberos 4 features, this new code will only support Kerberos 5. As a result, sites using Kerberos 4 will not be able to take advantage of this new feature. In addition, since this feature will be replacing existing code in Kerberos for Macintosh and Kerberos for Windows, the Kerberos 4 user experience on Windows an Mac OS X will be noticeably worse than in previous releases.
The first phase of this transition is to ensure that we have a complete and accurate list of all of the services that only support v4 today. We then need to group the services into three categories:
- obsolete applications / services and set to be phased out
- applications with a migration path to Kerberos v5
- provide alternate authentication or access to the service
The first major changes which impact Kerberos 4 support are currently scheduled for krb5-1.5 (May of 2006), Kerberos for Macintosh 6.0 (which will ship with Mac OS X Leopard), and Kerberos for Windows 3.1 (approximately June 2006).
There are no plans to remove Kerberos 4 support from earlier major releases of any of our products (ie: krb5 1.4.x, KfM 5.5.x (Tiger) and KfW 3.0.x). As a result, currently released operating system versions (and their software updates) will most likely continue to provide Kerberos 4 support pass December 2006.
The MIT Kerberos Team has ended active development of Kerberos 4, except for the eventual removal of all Kerberos 4 functionality. They will continue to provide critical security fixes for Kerberos 4, but routine bug fixes and feature enhancements are at an end.
Below, please find our initial application / services list. Please let us know of any omissions by looking at the list below, and responding to (Insert email list here) with any applications that are not included.
Immediate next steps include...
- outreach and communication with the business owners / IT professionals with these applications / services
- announcement with IT-Partners
- community wide announcement in January 2006
We look forward to hearing from you.
Contact: v4-retire AT SPAMFREE mit DOT edu